Event ID 1005, source MSExchangeDiagnostics, performance counter...% Processor Time sustained a value...

I'm going through my Exchange Server's logs and checking out warnings and errors, and I haven't been able to find anything helpful on this one in the application log of the Windows Server 2012 R2 virtual machine running Exchange Server 2013 SP1 only:

Event ID 1005 warning, source MSExchangeDiagnostics

The performance counter '\\<ServerName>\Processor(_Total)\% Processor Time' sustained a value of '85.73', for the '5' minute(s) interval starting at '4/3/2015 10:40:00 AM'. Additional information: 
Top 10 process time breakdown:
CPU % Process Name
 37.3 SvcHost#netsvcs
 26.8 TiWorker
 21.6 WmiPrvSE
 11.4 w3wp#MSExchangeMapiMailboxAppPool
 11.3 w3wp#MSExchangeECPAppPool
 10.5 SvcHost#LocalServiceNetworkRestricted
 10.2 w3wp#MSExchangeOWAAppPool
  7.6 NodeRunner#ContentEngineNode1
  7.3 w3wp#MSExchangePowerShellAppPool
  5.9 w3wp#MSExchangeSyncAppPool

I'd appreciate any insight into what this warning is telling me and what I need to do to resolve the causing issue.  Thanks!

April 14th, 2015 10:34am

The obvious answer is to add more processors or another server and split the load.
Free Windows Admin Tool Kit Click here and download it now
April 14th, 2015 9:27pm

Hi ,

Thank you for your question.

As Ed said, this error is related to CPU performance, we could check if there are any virus on Exchange server. then, we could click task manager to check if there are other applications which was occurred on Exchange server (as you said, you just install Exchange on this server), we could add processor on this virtual machine to check if the issue persist.

If there are any questions regarding this issue, please be free to let me know. 

Best Regard,

April 15th, 2015 4:38am

Thanks guys.  Someone on another site put forward the same explanation.  This event only occurs on system start, so I think there must be a spike on processor utilization at that point.  After the boot sequence is complete, utilization calms down to about 30% on average, and the event does not get logged again, so I think this event is safe to ignore as long as it only occurs on system start.
Free Windows Admin Tool Kit Click here and download it now
April 15th, 2015 4:29pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics